CVE-2026-13716
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbit
CVSS
9.1
Crítico
EPSS
0.7%
p52
KEV
—
Exploit Today
16
0-100
Publicado: 11 ago 2026 · Última mod.: 18 ago 2026 · CWE-35
0.6%EPSS · 30 días0.7%
2026-08-112026-08-30
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-599097.1 ALT1.9%
——1Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.12dCVE-2026-560893.3 BAJ3.4%
——1Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.12dCVE-2026-281577.5 ALT29.9%
——9Subscriber Path Traversal in Do Lasso <= 358 versions.16dCVE-2026-691097.5 ALT38.9%
——12A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application.2dCVE-2026-591159.9 CRÍ53.0%
——16'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.23dCVE-2026-666956.5 MED18.0%
——5Unauthenticated Path Traversal in W3 Total Cache <= 2.10.2 versions.18d